Over 250 ClickFix Domains Use Browser Fingerprinting to Hide macOS Malware Lures

Microsoft Threat Intelligence has uncovered a macOS ClickFix operation that uses more than 250 front-end domains to distribute malware, including MacSync and Atomic Stealer (AMOS). The campaign employs a server-side fingerprinting gate that analyzes browser characteristics to decide whether to display a malicious lure, effectively hiding the attack from crawlers and sandboxes.

The fingerprinting script, about 2.5 KB of JavaScript, reads navigator values such as the platform string (expecting MacIntel), screen and window dimensions, WebGL graphics signals, timezone, iframe status, and touch support. It also includes two anti-analysis probes: a counter that detects when the developer console is open, and a call to canPlayType(“video/mp4″) used as a tripwire for stealth browsers faking codec support. The fingerprint is sent to the server with a mode:”php” tag, and the server decides what content to serve.

Qualifying Mac users receive a GitHub-themed “Download for macOS” page with a forged “Verified Publisher” badge, prompting them to copy and run an obfuscated command in Terminal. This command retrieves scripts from a /curl/ path and launches AMOS, an infostealer targeting credentials, browser data, authentication stores, cryptocurrency wallets, and sensitive files. Microsoft did not disclose victim numbers, targeted sectors, or operator identity.

Defenders are advised to hunt for the fingerprinting gate rather than the malware itself: watch for self-submitting fingerprint forms, hidden fingerprint fields, and the mode:”php” artifact, and block on shared staging infrastructure and /curl/ paths. Apple has released macOS 26.4 with protections including a Terminal confirmation prompt and enhanced XProtect capabilities to trace pasted commands and block known malware activity.